---
title: "OAuth 2.0 authorize endpoint"
method: POST
path: "/oauth/authorize"
tags: ["auth"]
---

# OAuth 2.0 authorize endpoint

`POST /oauth/authorize`

## Request

- Base URL: `/api/v1` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/v1/oauth/authorize`
- Auth: API key in header `Authorization`

Creates an authorization code for an OAuth 2.0 client on behalf of the authenticated user. PKCE is required. API tokens cannot be used to authorize a client.

## Request body

- Oauth2serverAuthorizeRequest
  - `client_id` string
  - `code_challenge` string
  - `code_challenge_method` string
  - `redirect_uri` string
  - `response_type` string
  - `state` string

## Response `200`

The authorization code and the redirect URI to return it to.

- Oauth2serverAuthorizeResponse
  - `code` string
  - `redirect_uri` string
  - `state` string

## Other responses

- `400`: response_type is not 'code', the redirect URI is invalid, or the PKCE challenge is missing.
- `403`: An API token was used to authorize an OAuth client.
- `500`: Internal server error.

## Changes

- **2026-09-10** `0cee97c2eb8e`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/go-vikunja/apis/vikunja-api/changes/oauth/authorize/post.md)

---

[API](https://skmtc.dev/go-vikunja/apis/vikunja-api.md) - [All operations](https://skmtc.dev/go-vikunja/apis/vikunja-api/llms.txt) - [OpenAPI document](https://skmtc.dev/go-vikunja/apis/vikunja-api/revisions/12ae97e7e29c?raw)